Applying a packet routing policy to an application session

ABSTRACT

A security gateway includes packet routing policies, each including a host network address, an application network address, and a forwarding interface. In routing data packets of an application session, the security gateway: recognizes the application session between a network and an application; determines a user identity from an application session record for the application session; determines packet routing policies applicable to the application session based on the user identity; receives a data packet for the application session, including a source network address and a destination network address; compares the source network address with the host network address, and the destination network address with the application network address; and in response to finding a match between the source network address and the host network address, and between the destination network address and the application network address, processes the data packet using the forwarding interface of the packet routing policy.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present application is a continuation and claims the prioritybenefit of U.S. patent application Ser. No. 14/323,920, filed on Jul. 3,2014, issued as U.S. Pat. No. 9,253,152 on Feb. 2, 2016; which in turnis a continuation U.S. patent application Ser. No. 14/061,722, filed onOct. 23, 2013, issued as U.S. Pat. No. 8,826,372 on Sep. 2, 2014; whichin turn is a continuation of U.S. patent application Ser. No.13/716,124, filed on Dec. 15, 2012, issued as U.S. Pat. No. 8,584,199 onNov. 12, 2013; which in turn is a continuation-in-part of U.S. patentapplication Ser. No. 13/650,179, filed on Oct. 12, 2012, issued as U.S.Pat. No. 8,595,791 on Nov. 26, 2013; which in turn is a continuation ofU.S. patent application Ser. No. 12/788,339, filed on May 27, 2010,issued as U.S. Pat. No. 8,312,507 on Nov. 13, 2012; which in turn is acontinuation-in-part of U.S. patent application Ser. No. 12/771,491,filed on Apr. 30, 2010, issued as U.S. Pat. No. 7,979,585 on Jul. 12,2011; which in turn is a continuation of U.S. patent application Ser.No. 11/582,613, filed on Oct. 17, 2006, issued as U.S. Pat. No.7,716,378, on May 11, 2010. The disclosures of the above referencedapplications are hereby incorporated by reference.

BACKGROUND OF THE INVENTION

1. Field

This invention relates generally to data networking, and morespecifically, to a system and method to apply a packet routing policybased on a user identity during an application session.

2. Related Art

The secure data network of a company is a critical component forday-to-day functioning of company business activities. Company employeesaccess the secure data network for communication within the company andwith the outside world. Company information, oftentimes proprietary orconfidential, is exchanged during the communication.

Typically, an employee gains access to the company's secure data networkby means of a network logon procedure using a private user identity,such as a user name “Robert P. Williamson” or an employee number“NG01-60410”. Subsequent information exchange using the company's officeapplications, such as email, file transfer or document control istraceable based on the private user identity through network event logs.

Since the late 1990's, we have been witnessing the phenomenal risingpopularity of public communication applications and services, such asemail and Instant Messaging offered by Yahoo™, America Online™ (AOL), orGoogle™, conferencing and collaboration services offered by WebEx™ orCentra™, or peer-to-peer services for a variety of file sharing.Generally, a public communication service allows a user to exchangeinformation through messaging, text chat or document exchange using apublic user identity, such as “butterdragon”, “fingernaill984”, or“peterrabbit”.

However, in a company setting, when an employee connects to a publiccommunication service with a public user identity over the company'ssecure data network, the information exchange is not easily traceable ifat all since the public user identity is not tied to the private useridentity.

In one example, a company's information technology (IT) departmentnotices that an employee Victor has been using the company's emailsystem to send out proprietary documents, violating the company'ssecurity policy. After issuing a warning to Victor, the IT departmentfinds no further violations. Unfortunately, they are not aware of thefact that Victor has continued this activity using Yahoo™ email with apublic user identity “PiratesOfCaribbean@Yahoo.com”.

In another example, two weeks before a major trade show, a companyimplements a security measure to monitor communication activities ofemployees of director level and above to ensure confidentiality ofcompetitive information. This security measure, covering company email,phone conversation and voice messaging, nevertheless proves to be afailure as sensitive information leaks out to a business reporter anywayprior to the trade show. The source of the leak may never be confirmed,but the business reporter privately discloses that he gets theinformation from an anonymous employee of the company using AOL InstantMessaging™ with screen name “opensecret2006”.

In addition to associating a user identity to an application session,the company often desires to handle the network traffic of theassociated application session in a control or isolated manner.

The above discussion illustrates a need for a security driven packetforwarding solution to associate a user identity to an application.

BRIEF SUMMARY OF THE INVENTION

According to some embodiments of the present invention, a method forrouting data packets of an application session, comprises: recognizingthe application session between a network and an application via asecurity gateway; determining by the security gateway a user identityfrom an application session record for the application session, whereinthe application session record comprises a user identity used foraccessing a network through a host, a host identity for the host, and anapplication session time, wherein a creating of the application sessionrecord comprises: querying an identity server by sending the hostidentity and the application session time in the application sessionrecord, wherein the identity server comprises an access session recordfor an access session between a second host and the network, wherein theaccess session record comprises a second user identity used foraccessing the network through the second host, a second host identityfor the second host, and an access session time, wherein the identityserver compares the host identity in the application session record withthe second host identity in the access session record, and comparing theaccess session time with the application session time, wherein theidentity server returns the second user identity in the access sessionrecord, if the host identity in the application session record matchesthe second host identity in the access session record, and if the accesssession time matches the application session time; and storing thesecond user identity as a network user identity used for accessing thenetwork in the application session record; determining one or morepacket routing policies applicable to the application session based onthe user identity, each packet routing policy comprising a host networkaddress, an application network address, and a forwarding interface;receiving a data packet for the application session by the securitygateway, the data packet comprising a source network address and adestination network address; comparing, by the security gateway, thesource network address from the data packet with the host networkaddress of each packet routing policy, and comparing the destinationnetwork address from the data packet with the application networkaddress of each packet routing policy; and in response to finding amatch between the source network address and the host network address ofa given packet routing policy, and between the destination networkaddress and the application network address of the given packet routingpolicy, processing the data packet using the forwarding interface of thegiven packet routing policy by the security gateway.

In one aspect of the present invention, the security gateway comprises anetwork interface, wherein the forwarding interface of the given packetrouting policy indicates transmission of data packets using the networkinterface, wherein the processing further comprises: in response tofinding the match between the source network address and the hostnetwork address of the given packet routing policy, and between thedestination network address and the application network address of thegiven packet routing policy, transmitting the data packet using thenetwork interface of the security gateway.

In one aspect of the present invention, the security gateway is coupledto a network element, wherein the forwarding interface of the givenpacket routing policy directs the security gateway to send data packetsto the network element, wherein the processing further comprises: inresponse to finding the match between the source network address and thehost network address of the given packet routing policy, and between thedestination network address and the application network address of thegive packet routing policy, transmitting the data packet to the networkelement using the network interface of the security gateway.

In one aspect of the present invention, the one or more packet routingpolicies comprise a second given packet routing policy associated withthe network element, the second given packet routing policy comprising asecond host network address, a second application network address, and asecond forwarding interface, wherein the determining the one or morepacket routing policies further comprises: determining by the securitygateway that the second given packet routing policy is associated withthe network element; and in response to determining that the secondgiven packet routing policy is associated with the network element,sending the second given packet routing policy to the network element bythe security gateway.

In one aspect of the present invention, the forwarding interface of thegiven packet routing policy indicates transmission of data packets tothe network element, wherein the processing further comprises: inresponse to finding the match between the source network address and thehost network address of the given packet routing policy, and between thedestination network address and the application network address of thegiven packet routing policy, transmitting the data packet to the networkelement by the security gateway.

In one aspect of the present invention, the method further comprises:receiving the data packet from the security gateway by the networkelement; comparing, by the network element, the source network addressfrom the data packet with the second host network address of the secondgiven packet routing policy, and comparing the destination networkaddress from the data packet with the second application network addressof the second given packet routing policy; and in response to finding amatch between the source network address and the second host networkaddress, and between the destination network address and the secondapplication network address, processing the data packet using the secondforwarding interface of the second given packet routing policy by thenetwork element.

In one aspect of the present invention, the method further comprises:generating a security report based on the application session record andthe one or more packet routing policies.

System and computer program products corresponding to theabove-summarized methods are also described and claimed herein.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1A illustrates a secure network according to an embodiment of thepresent invention.

FIG. 1B illustrates an access session and an application sessionaccording to an embodiment of the present invention.

FIG. 1C illustrates an access session record and an application sessionrecord according to an embodiment of the present invention.

FIG. 2 illustrates a process to generate an application session recordaccording to an embodiment of the present invention.

FIG. 3 illustrates a process to recognize an application sessionaccording to an embodiment of the present invention.

FIG. 4A illustrates a process to determine a public user identity ofapplication session according to an embodiment of the present invention.

FIG. 4B illustrates a data packet in an AIM log-on packet according toan embodiment of the present invention.

FIG. 5 illustrates a process to determine a private user identityaccording to an embodiment of the present invention.

FIG. 6 illustrates an embodiment of a security gateway obtaining asecurity policy by querying a corporate directory according to anembodiment of the present invention.

FIG. 7 illustrates a security policy including a security controlaccording to an embodiment of the present invention.

FIG. 8 illustrates a plurality of embodiments of network traffic policyaccording to an embodiment of the present invention.

FIG. 9 illustrates a security policy that includes a packet routingpolicy according to an embodiment of the present invention.

FIG. 10 illustrates a security gateway connected to a network elementaccording to an embodiment of the present invention.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1A illustrates a secure network according to an embodiment of thepresent invention.

A secure network 160 includes a host 130. User 120 uses host 130 toaccess a public application 180 hosted in application server 190.Application server 190 is outside of secure network 160. The networktraffic between host 130 and application server 190 passes throughsecurity gateway 150. The security gateway 150 is operationally coupledto a processor 171 and a computer readable medium 172. The computerreadable medium 172 stores computer readable program code forimplementing the various embodiments of the present invention asdescribed herein.

Host 130 is a computing device with network access capabilities. Thehost 130 is operationally coupled to a processor 173 and a computerreadable medium 174. The computer readable medium 174 stores computerreadable program code for implementing the various embodiments of thepresent invention as described herein. In some embodiments, host 130 isa workstation, a desktop personal computer or a laptop personalcomputer. In some embodiments, host 130 is a Personal Data Assistant(PDA), a smartphone, or a cellular phone.

In some embodiments, secure network 160 is an Internet Protocol (IP)network. In some embodiments, secure network 160 is a corporate datanetwork or a regional corporate data network. In some embodiments,secure network 160 is an Internet service provider network. In someembodiments, secure network 160 is a residential data network. In someembodiments, secure network 160 includes a wired network such asEthernet. In some embodiments, secure network 160 includes a wirelessnetwork such as a WiFi network.

Public application 180 provides a service that allows user 120 tocommunicate with other users in a real-time fashion. In someembodiments, the service includes text chat. In some embodiments, theservice includes a voice call or a video call. In some embodiments, theservice includes a network game. In some embodiments, the serviceincludes exchanging a document, such as sending or receiving a textdocument, a PowerPoint™ presentation, an Excel™ spreadsheet, an imagefile, a music file or a video clip. In some embodiments, the serviceincludes a collaborative document processing such as creating adocument, a business plan, an agreement, wherein user 120 collaborateswith other users in a real time fashion. In some embodiments, theservice includes a collaborative information exchange such as aconference call. In some embodiments, the service is a social networkingservice. In some embodiments, the service includes real-timecollaboration and non real-time collaboration.

In one example, public application 180 provides America Online InstantMessenger™ service. In one example, public application 180 providesYahoo Instant Messenger™ voice service. In some embodiments, publicapplication 180 provides a file sharing service such as Kazaa™ filesharing service. In some embodiments, public application 180 provides anetwork game service such as Microsoft™ Network Game service. In someembodiments, public application 180 provides an on-line collaborativedocument processing such as Google Docs™, and Salesforce.com™. In someembodiments, public application 180 provides an on-line informationexchange and communications such as WebEx™. In some embodiments, publicapplication 180 provides live information streaming such as live videostreaming, live audio streaming, and instantaneous picture uploading.

Security gateway 150 is situated at the edge of secure network 160.Security gateway 150 connects secure network 160 to public application180. Security gateway 150 receives network traffic from secure network160 and transmits the network traffic to application server 190.Likewise, security gateway 150 receives network traffic from applicationserver 190 and transmits the network traffic to secure network 160.

In some embodiments, security gateway 150 includes the function of acorporate Wide Area Network (WAN) gateway. In some embodiments, securitygateway 150 includes the function of a residential broadband gateway. Insome embodiments, security gateway 150 includes the function of a WANgateway for an Internet service provider.

FIG. 1B illustrates an access session and an application sessionaccording to an embodiment of the present invention.

User 120 uses host 130 to access secure network 160 during an accesssession 162.

Host 130 has a host identity 134. Host 130 uses host identity 134 toconnect to secure network 160. In some embodiments, host identity 134includes an Internet Protocol (IP) address. In some embodiments, hostidentity 134 includes a Media Access Control (MAC) address.

Within secure network 160, user 120 has a private user identity 124. Insome embodiments, private user identity 124 is an employee number or anemployee name. In some embodiments, private user identity 124 is anInternet service subscription identity. In some embodiments, accesssession 162 is established after a successful network user log-inprocedure, such as an employee network log-in, for secure network 160using private user identity 124. Private user identity 124 is associatedwith host identity 134. In some embodiments, host 130 is a guestcomputing device. Private user identity 124 is associated with anEthernet switch port where host 130 connects. In this embodiment,private user identity 124 is a port number, an Ethernet interfaceidentity, or an Ethernet VLAN identity.

User 120 uses host 130 to access public application 180 in anapplication session 182. User 120 uses a public user identity 127 duringapplication session 182. In some embodiments, public application 180prompts user 120 to log-in before establishing application session 182.During the application user log-in procedure, user 120 provides topublic application 180 public user identity 127. In another embodiment,public application 180 selects a public user identity 127 for user 120for application session 182. In some embodiments, public user identity127 is set up through a user registration process or a servicesubscription process. Network traffic in application session 182 passesthrough security gateway 150.

FIG. 1C illustrates an access session record and an application sessionrecord according to an embodiment of the present invention.

Access session record 164 records information about access session 162.The information includes private user identity 124, host identity 134and access session time 166. In some embodiments, access session time166 is the starting time when access session 162 is established. In someembodiments, access session time 166 includes the starting time and theending time when user 120 finishes access session 162. In someembodiments, access session time 166 is a time stamp for a time duringaccess session 162.

Application session record 184 records information about applicationsession 182. The information includes private user identity 124, publicuser identity 127, and application session time 186. In someembodiments, the information further includes host identity 134. In someembodiments, application session time 186 includes the starting timewhen application session 182 is established. In some embodiments,application session time 186 includes a time stamp during applicationsession 182. In some embodiments, application session time 186 includesa time stamp when security gateway 150 recognizes application session182.

FIG. 2 illustrates a process to generate an application session recordaccording to an embodiment of the present invention.

The process of generating application session record 184 includesmultiple steps.

In step 201, security gateway 150 recognizes an application session.

In step 202, security gateway 150 determines a public user identity ofthe application session.

In step 203, security gateway 150 determines a private user identityusing information about the application session.

FIGS. 3-5 illustrates steps 201-203 respectively.

FIG. 3 illustrates a process to recognize an application sessionaccording to an embodiment of the present invention.

Security gateway 150 inspects network traffic between host 130 andapplication server 190 to recognize application session 182 for publicapplication 180.

In some embodiments, security gateway 150 inspects data packet 339between host 130 and application server 190 for the recognition ofapplication session 182.

Security gateway 150 includes an application identifier 355 for publicapplication 180. Application identifier 355 includes information forrecognizing application session 182. In some embodiments, applicationidentifier 355 includes a transport layer information, such asTransmission Control Protocol (TCP) or User Diagram Protocol (UDP); andat least one transport port number, such as a TCP port number or a UDPport number. In some embodiments, application identifier 355 includesapplication layer information, such as one or more data filters whereina data filter specifies a value and a position of the value in a datapacket. In one example, a data filter is [byte 0 with value “0x52”]. Inone example, a data filter is [byte 4-7 with ASCII value of “ADER”].

Security gateway 150 matches data packet 339 against applicationidentifier 355.

In some embodiments, application identifier 355 includes transportprotocol type of TCP and a destination TCP port number of 5190, the TCPport number used by AIM protocol. In this embodiment, data packet 339 isa TCP packet from host 130 to application server 190. Security gateway150 matches data packet 339 against application identifier 355 anddetermines that public application 180 provides AIM service.

Security gateway 150 creates application session record 184. Securitygateway 150 extracts the source IP address from the IP header of datapacket 339 and stores the source IP address as host identity 134. Insome embodiments, data packet 339 includes link layer information, suchas a source MAC address; security gateway 150 extracts and stores thesource MAC address as host identity 134.

In some embodiments, security gateway 150 connects to a clock 359. Clock359 indicates the current time of day. Security gateway 150 stores thetime of day indicated by clock 359 in application session time 186.

FIG. 4A illustrates a process to determine a public user identity ofapplication session 182 according to an embodiment of the presentinvention.

The method for determining public user identity 127 is typicallyspecific to public application 180. In some embodiments, data packet 339is an application packet. For example, public application 180 providesAIM service; data packet 339 is an AIM packet.

An AIM packet includes multiple fields, for example Command start fieldis a I-byte data field starting at byte offset 0 having a fixedhexadecimal value “0x02”;

Channel ID field is a 1-byte data field starting at byte offset 1;

Sequence number field is a 2-byte integer starting at byte offset 2;

Data field length field is a 2-byte data field starting at byte offset4;

Family field is a 2-byte data field starting at byte offset 6; and

Subtype field is a 2-byte data field starting at byte offset 8.

An AIM log-on packet is a AIM packet with family field having a fixedhexadecimal value of “0x00 0x17” and subtype field having a fixedhexadecimal value of “0x00 0x06”.

AIM log-on packet further includes buddy name length field, a 1-byteinteger starting at byte offset 19, and a variable length buddy namefield starting at byte offset 20. Buddy name length field indicates thelength in bytes of buddy name field.

Security gateway 150 matches data packet 339 to determine if data packet339 is an AIM log-on packet. In some embodiments, data packet 339 is anAIM log-on packet 400 illustrated in FIG. 4B. Security gateway 150extracts buddy name length field 405. Security gateway 150 furtherextracts buddy name field 407. In this embodiment, buddy name lengthfield 405 is integer “13” and buddy name field 407 is “JohnSmith1984”.Security gateway 150 stores “JohnSmith1984” as public user identity 127in application session record 184.

In some embodiments, data packet 339 is not an AIM log-on packet.Security gateway 150 inspects another data packet from host 130.

FIG. 5 illustrates a process to determine a private user identityaccording to an embodiment of the present invention.

Secure network 160 includes an identity server 570. The identity server570 is operationally coupled to a processor 581 and a computer readablemedium 582. The computer readable medium 582 stores computer readableprogram code for implementing the various embodiments of the presentinvention as described herein. Identity server 570 includes accesssession record 164 of access session 162 during which user 120 accessesapplication session 182.

Security gateway 150 queries identity server 570. Security gateway 150sends host identity 134 and application session time 186 to identityserver 570.

Identity server 570 receives host identity 134 and application sessiontime 186. Identity server 570 matches host identity 134 and applicationsession time 186 against access session record 164. Identity server 570determines that host identity 134 matches host identity of accesssession record 164. Identity server 570 further determines thatapplication session time 186 matches access session time 166 of accesssession record 164 as application session time 186 is between thestarting time and the ending time of access session record 164. Identityserver 570 sends private user identity 124 of access session record 164to security gateway 150 as a response to the query.

Security gateway 150 receives private user identity 124 from identityserver 570, and stores private user identity 124 in application sessionrecord 184.

In some embodiments, security gateway 150 stores public user identity127 in application session record 184 after recognizing a log-onapproval indication for the public user identity 127 from publicapplication 180.

In some embodiments, security gateway 150 queries identity server 570immediately after determining public user identity 127. In someembodiments, security gateway 150 queries identity server 570 afterapplication session 182 ends.

In some embodiments, security gateway 150 queries identity server 570 bysending a plurality of host identities in a bulk request; and receives aplurality of private user identities in a bulk response.

In some embodiments, application session record 184 includes additionaluser information associated with private user identity 124, such ascubicle or office number, cubicle or office location, telephone number,email address, mail-drop location, department name/identity, or managername.

In some embodiments, security gateway 150 obtains the additional userinformation from identity server 570. In some embodiments, securitygateway 150 obtains the additional user information by querying adifferent server, such as a corporate directory server, by using theprivate user identity 124 received from identity server 570.

In some embodiments, public application 180 provides file transferservice using File Transfer Protocol (FTP) protocol or a proprietaryprotocol. In some embodiments, public application 180 provides emailservice using Simple Mail Transfer Protocol (SMTP), Internet MessageAccess Protocol (IMAP) or Post Office Protocol version 3 (POP3)protocol.

By using the application session record, the private user identity 124and the public user identity 127 for an application session 182 may bedetermined. In some embodiments as illustrated by FIG. 6, upondetermining the pubic user identity and the private user identity,security gateway 150 obtains security policy 402 for the applicationsession 182 by querying corporate directory 470. In an embodiment,corporate directory 470 comprises security policy 402. In someembodiments, corporate directory 470 is a server computer comprising astorage 601 that includes security policy 402. In some embodiments,corporate directory 470 is a database comprising security policy 402. Inanother embodiment, corporate directory 470 is a software module withprogram code stored on a computer readable medium (not shown) running ina computer. In some embodiments, corporate directory 470 resides inidentity server 570. In some embodiments, corporate directory 470 usesdirectory technologies such as Microsoft Active Directory™, lightweightdirectory access protocol (LDAP) directory services, web services,directory services using Java™ technologies. In some embodiments,corporate directory 470 includes a policy server hosting security policy402 and other policies.

Security gateway 150 queries corporate directory 470 for a securitypolicy, where the query includes user identity 424. User identity 424may include private user identity 124 or public user identity 127.Corporate directory 470 matches user identity 424 against securitypolicy 402 and determines security policy 402 is applicable to useridentity 424. In some embodiments security policy 402 maps networkparameters to a user identity and there is a match between user identity424 and the user identity in the security policy 402. In someembodiments, security policy 402 maps network parameters to a groupidentity (not shown) and user identity 424 is a member of the groupidentity. In response to finding the match between the user identity 424and the user identity in the security policy 402, corporate directory470 sends security policy 402 to security gateway 150.

In some embodiments, security gateway 150 generates security report 475based on application session record 184 and security policy 402. In someembodiments, security gateway 150 generates security report 475 based ona pre-determined user identity or a list of pre-determined useridentities. For example, the security report may be generated based onan input of user identity or identities. In some embodiments, securitygateway 150 generates security report 475 based on a pre-definedschedule or when requested by an operator.

In some embodiments, security policy 402 includes a security controlfunction as illustrated in FIG. 7. Security gateway 150 applies thesecurity policy 402 received from corporate directory 470 in response tothe query to application session 182. Security policy 402 typically areconfigured by a company to protect against improper access to thecompany confidential documents and to protect against improper usage ofthe company secure network 160 vital for the company operation. In someembodiments, in response to receiving the security policy 402, thesecurity gateway 150 confirms that the received security policy 402contains a user identity that matches the user identity 424 sent in thequery. In response to the confirmation, the security gateway 150 appliesthe security policy 402 to the application session 182. In FIG. 7,security policy 402 includes network traffic policy 451 or documentaccess policy 453.

FIG. 8 illustrates a plurality of embodiments of network traffic policy451 according to various embodiments of the present invention. In someembodiments, network traffic policy 451 specifies network basedapplication session access control indicating if user identity 424 isdenied or allowed to continue application session 182. If denied,security gateway 150 may stop forwarding data packets 439 of applicationsession 182. In some embodiments, network traffic policy 451 specifiesbandwidth rate capacity such as 1 Mbps, 100 MB per day, or 5 GB permonth. In an embodiment, bandwidth rate capacity is measured in packetssuch as 100 packets per second, 10 thousand packets per day or 4 millionpackets per month. In some embodiments, network traffic policy 451specifies a quality of service (QOS) mapped to user identity 424 forapplication session 182. For example, network traffic policy 451indicates a change of Differentiated Services Code Point (DSCP) markingin the data packets 439 of application session 182. In some embodiments,network traffic policy 451 specifies a queuing delay, a queuingpriority, a packet forwarding path, a link interface preference, aserver load balancing preference, a packet routing policy, or othercontrol to handle data packets 439 of application session 182.

In some embodiments, network traffic policy 451 includes a trafficshaping control. In one example, traffic shaping control specifies a TCPprofile such as a change of window segment size, or a TCP windowadjustment.

In some embodiments, network traffic policy 451 indicates sessionconnection rate control based on user identity 424 specifying a rate orcapacity such as 10 session connections per second, 35 concurrentsessions, 100 sessions during lunch hour, 500 sessions a day, 24 voicesessions a day, or 75 file transfer sessions an hour. In someembodiments, network traffic policy 451 may specify, when exceeding therate or capacity, if application session 182 is denied or data packets439 of application session 182 are dropped.

In some embodiments, network traffic policy 451 includes applicationsession modification control mapped to user identity 424, specifying howdata packets 439 of application session 182 are modified for the userwith the user identity 424. In one example, application sessionmodification control specifies security gateway 150 should performnetwork address translation (NAT) to application session 182 for useridentity 424. In one example, security gateway 150 should perform portaddress translation (PAT) to application session 182 using apre-determined port number for user identity 424. In another example,security gateway 150 should perform content substitution if applicationsession 182 is an HTTP session and if a Universal Resource Locator (URL)in data packets 439 of application session 182 matches a pre-determinedURL for user identity 424. In an example, security gateway 150 shouldperform filename substitution if application session 182 is a filetransfer session and if a filename matching a pre-determined filename isfound in data packets 439 of application session 182 for user identity424. In another example, security gateway 150 should insert a cookie foruser identity 424 if application session 182 is an HTTP session, withoptionally data packets 439 matching a pre-determined POST or GETrequest of a URL.

Returning to FIG. 7, in some embodiments, document access policy 453specifies if access to document 447 is allowed or denied. In someembodiments, document 447 includes a file, a business agreement, acontract, a spreadsheet, a presentation, a drawing, a textual document,a manual, a program, a piece of software program, a design, a productspecification, a datasheet, a video file, an audio file, an email, avoice mail, a fax, a photocopy of a document, or any business document.In some embodiments, document 447 includes a URL leading to digitalinformation such as database query result, a web page, a video, or apiece of music. In some embodiments, document 447 includes real timetransfer or streaming of information such as video streaming, audiostreaming, a webcast, a podcast, a video show, a teleconference session,or a phone call. In some embodiments, document access policy 453includes document identity 443 and document user identity 444. Documentidentity 443 identifies document 447. Document user identity 444identifies the user whose access to the document 447 is affected by thedocument access policy 453. In an embodiment, security gateway 150compares user identity 424 with document user identity 444. In responseto determining that the user identity 424 matches the document useridentity 444, in some embodiments, security gateway 150 allows document447 with document identity 443 to be accessed by user identity 424. Inanother embodiment, security gateway 150 denies access to document 447with document identity 443. In denying access, the security gateway 150may disconnect application session 182 or discard data packets 439. Insome embodiments, security gateway 150 confirms that data packets 439include document identity 443. In response to confirming that datapackets 439 include document identity 443, security gateway 150 appliesdocument access policy 453.

In some embodiments security policy 402 includes time 457 where securitypolicy 402 is applicable within time 457. In some embodiments, time 457indicates a beginning time such as 8 am, 4 pm, midnight. In anembodiment, time 457 indicates a time range such as 8 am to 10 am, 7 pmto 5 am, morning hours, lunch, rush hour, prime time. Security gateway150 compares clock 359 with time 457 and determines if security policy402 is applicable.

In some embodiments, security gateway 150 generates security message 472when security gateway 150 determines if security policy 402 isapplicable to application session 182 for user identity 424. In someembodiments, security gateway generates security message 472 whensecurity gateway 150 applies security policy 402 to application session182. In some embodiments, security report 475 includes security message472. In one example, security message 472 includes security policy 402and user identity 424. In one example, security message 472 includes theactions security gateway 150 applies to application session 182 usingsecurity policy 402.

FIG. 9 illustrates an embodiment where security policy 402 includes apacket routing policy 652 according to an embodiment of the presentinvention. Security gateway 150 is configured to receive and applypacket routing policy 652 of network traffic policy 451 to data packet439 of application session 182. In some embodiments, packet routingpolicy 652 includes host network address 661, application networkaddress 663 and forwarding interface 665. In some embodiments, hostnetwork address 661 includes IP address of host 130. In someembodiments, host network address 661 includes a transport layeridentity such as TCP port number or UDP port number of applicationsession 182. In some embodiments, application network address 663includes IP address of application server 190. In some embodiments,application network address 663 includes a transport layer informationsuch as TCP port number or UDP port number of application session 182.

Security gateway 150 applies packet routing policy 652 for data packet439 of application session 182 by first comparing data packet 439against packet routing policy 652. In some embodiments, security gateway150 obtains source network address of data packet 439, which may includesource IP address and source transport layer information. In someembodiments, security gateway 150 obtains destination network address ofdata packet 439, which may include destination IP address anddestination transport layer information. Security gateway 150 comparessource network address of data packet 439 against host network address661, and in some embodiments, compares destination network address ofdata packet 439 against application network address 663. When there ismatch, security gateway 150 processes data packet 439 using forwardinginterface 665. In some embodiments, security gateway 150 includes anetwork interface 671 and forwarding interface 665 indicatestransmitting data packet 439 using network interface 671. In someembodiments, forwarding interface 665 indicates a modification to beapplied to data packet 439 prior to transmission. In some embodiments,the modification indicated in forwarding interface 665 is to add atunnel header, such as an IP-IP tunnel header, an L2TP tunnel header, anIPSec tunnel header, or a layer 2 tunnel header. Security gateway 150applies the modification to data packet 439 and sends the modified datapacket 439 to network interface 671.

In some embodiments illustrated in FIG. 10, security gateway 150connects to a network element 154. Embodiments of network element 154includes functionality of a network switch such as an Ethernet switch, arouter, a network gateway, a security gateway similar to securitygateway 150, a firewall, and a border gateway. In some embodiments,security policy 402 includes packet routing policy 652 and packetrouting policy 654. Packet routing policy 654 is associated with networkelement 154 and packet routing policy 652 is associated with securitygateway 150. Security gateway 150 applies security policy 402 by firstsending packet routing policy 654 to network element 154 such thatnetwork element 154 can apply packet routing policy 654. Securitygateway 150 applies packet routing policy 652 to data packet 439 ofapplication session 182 as illustrated in FIG. 9. In some embodiments,forwarding interface of packet routing policy 652 directs securitygateway 150 to send data packet 439 or modified data packet 439 tonetwork element 154.

In some embodiments, network element 154 receives data packet 439 ormodified data packet 439 from security gateway 150. Network element 154applies packet routing policy 654 to received data packet 439 in asimilar manner as security gateway 150 applying packet routing policy652 to data packet 439.

In some embodiments, packet routing policy 654 is associated with one ormore additional network elements. Security gateway 150 sends packetrouting policy 654 to the additional network elements.

In some embodiments, security gateway 150 applies packet routing policy654 in conjunction with other attributes of network traffic policy 451.

The invention can take the form of an entirely hardware embodiment, anentirely software embodiment or an embodiment containing both hardwareand software elements. In a preferred embodiment, the invention isimplemented in software, which includes but is not limited to firmware,resident software, microcode, etc.

Furthermore, the invention can take the form of a computer programproduct accessible from a computer-usable or computer-readable mediumproviding program code for use by or in connection with a computer orany instruction execution system. For the purposes of this description,a computer-usable or computer readable medium can be any apparatus thatcan contain, store, communicate, propagate, or transport the program foruse by or in connection with the instruction execution system,apparatus, or device.

The medium can be an electronic, magnetic, optical, electromagnetic,infrared, or semiconductor system (or apparatus or device) or apropagation medium. Examples of a computer-readable medium include asemiconductor or solid state memory, magnetic tape, a removable computerdiskette, a random access memory (RAM), a read-only memory (ROM), arigid magnetic disk and an optical disk. Current examples of opticaldisks include compact disk-read only memory (CD-ROM), compactdisk-read/write (CD-R/W) and DVD.

A data processing system suitable for storing and/or executing programcode will include at least one processor coupled directly or indirectlyto memory elements through a system bus. The memory elements can includelocal memory employed during actual execution of the program code, bulkstorage, and cache memories which provide temporary storage of at leastsome program code in order to reduce the number of times code must beretrieved from bulk storage during execution.

Input/output or I/O devices (including but not limited to keyboards,displays, point devices, etc.) can be coupled to the system eitherdirectly or through intervening I/O controllers.

Network adapters may also be coupled to the system to enable the dataprocessing system to become coupled to other data processing systems orremote printers or storage devices through intervening private or publicnetworks. Modems, cable modem and Ethernet cards are just a few of thecurrently available types of network adapters.

Foregoing described embodiments of the invention are provided asillustrations and descriptions. They are not intended to limit theinvention to precise form described. In particular, it is contemplatedthat functional implementation of invention described herein may beimplemented equivalently in hardware, software, firmware, and/or otheravailable functional components or building blocks, and that networksmay be wired, wireless, or a combination of wired and wireless. Othervariations and embodiments are possible in light of above teachings, andit is thus intended that the scope of invention not be limited by thisDetailed Description, but rather by the Claims following.

What is claimed is:
 1. A method for routing data packets of anapplication session, the method comprising: inspecting, by a securitygateway, a data packet for an application session and storing a hostidentity and an application session time in an application sessionrecord; determining, by the security gateway, from the data packet forthe application session a user identity and storing the user identity inthe application session record; determining, by the security gateway, asecond user identity by matching an access session record of an accesssession accessed during the application session that comprises thesecond user identity, a second host identity, and an access sessiontime, wherein the second host identity and the access session time matchthe host identity and the application session time of the applicationsession record; storing the second user identity in the applicationsession record; determining, by the security gateway, at least onepacket routing policy applicable to the application session, the atleast one packet routing policy comprising a host network address, anapplication network address, and a forwarding interface; receiving, atthe security gateway, a second data packet for the application session,the second data packet comprising a source network address and adestination network address; comparing, by the security gateway, thesource network address from the second data packet with the host networkaddress of the at least one packet routing policy, or comparing thedestination network address from the second data packet with theapplication network address of the at least one packet routing policy;and in response to finding a match between the source network addressfrom the second data packet and the host network address of the at leastone packet routing policy, or a match between the destination networkaddress from the second data packet and the application network addressof the at least one packet routing policy, processing the second datapacket using the forwarding interface of the at least one packet routingpolicy by the security gateway.
 2. The method of claim 1, wherein thesecurity gateway comprises a network interface, wherein the forwardinginterface of the at least one packet routing policy indicates amodification to be applied to the second data packet, wherein theprocessing further comprises: in response to finding the match betweenthe second data packet and the at least one packet routing policy,modifying the second data packet by the security gateway.
 3. The methodof claim 2, further comprising: transmitting the modified data packetusing the network interface of the security gateway.
 4. The method ofclaim 2, wherein the modifying the second data packet by the securitygateway comprises adding a tunnel header to the second data packet. 5.The method of claim 4, wherein the tunnel header is one of: an IP-IPtunnel header, an L2TP tunnel header, an IPSec tunnel header, or a layer2 tunnel header.
 6. The method of claim 1, wherein the security gatewayis coupled to a network element, wherein the forwarding interface of theat least one packet routing policy directs the security gateway to applya modification to the second data packet and send the second data packetto the network element, wherein the processing further comprises: inresponse to finding the match between the second data packet and the atleast one packet routing policy, modifying the second data packet by thesecurity gateway.
 7. The method of claim 6, further comprising:transmitting the modified data packet to the network element using anetwork interface of the security gateway.
 8. The method of claim 6,wherein the modifying the second data packet by the security gatewaycomprises adding a tunnel header to the second data packet.
 9. A system,comprising: a security gateway, wherein the security gateway: inspects adata packet for an application session and stores a host identity and anapplication session time in an application session record; determinesfrom the data packet for the application session a user identity andstores the user identity in the application session record; determines asecond user identity by matching an access session record of an accesssession accessed during the application session that comprises thesecond user identity, a second host identity, and an access sessiontime, wherein the second host identity and the access session time matchthe host identity and the application session time of the applicationsession record; stores the second user identity in the applicationsession record; determines at least one packet routing policy applicableto the application session, the at least one packet routing policycomprising a host network address, an application network address, and aforwarding interface; receives a second data packet for the applicationsession, the second data packet comprising a source network address anda destination network address; compares the source network address fromthe second data packet with the host network address of the at least onepacket routing policy, or compares the destination network address fromthe second data packet with the application network address of the atleast one packet routing policy; and in response to finding a matchbetween the source network address from the second data packet and thehost network address of the at least one packet routing policy, or amatch between the destination network address from the second datapacket and the application network address of the at least one packetrouting policy, processes the second data packet using the forwardinginterface of the at least one packet routing policy by the securitygateway.
 10. The system of claim 9, wherein the security gatewaycomprises a network interface, wherein the forwarding interface of theat least one packet routing policy indicates a modification to beapplied to the second data packet, wherein in processing the second datapacket, the security gateway: in response to finding the match betweenthe second data packet and the at least one packet routing policy,modifies the second data packet.
 11. The system of claim 10, wherein inprocessing the second data packet, the security gateway further:transmits the modified data packet using the network interface of thesecurity gateway.
 12. The system of claim 10, wherein in modifying thesecond data packet, the security gateway adds a tunnel header to thesecond data packet.
 13. The system of claim 12, wherein the tunnelheader is one of: an IP-IP tunnel header, an L2TP tunnel header, anIPSec tunnel header, or a layer 2 tunnel header.
 14. The system of claim9, further comprising a network element coupled to the security gateway,wherein the forwarding interface of the at least one packet routingpolicy directs the security gateway to apply a modification to thesecond data packet and send the second data packet to the networkelement, wherein in processing the second data packet, the securitygateway: in response to finding the match between the second data packetand the at least one packet routing policy, modifies the second datapacket by the security gateway.
 15. The system of claim 14, wherein inprocessing the second data packet, the security gateway further:transmits the modified data packet to the network element using anetwork interface of the security gateway.
 16. The system of claim 14,wherein in modifying the second data packet, the security gateway adds atunnel header to the second data packet.
 17. A non-transitory computerreadable storage medium having computer readable program code embodiedtherewith for routing data packets of an application session, thecomputer readable program code configured to: inspect, by a securitygateway, a data packet for an application session and storing a hostidentity and an application session time in an application sessionrecord; determine, by the security gateway, from the data packet for theapplication session a user identity and store the user identity in theapplication session record; determine, by the security gateway, a seconduser identity by matching an access session record of an access sessionaccessed during the application session that comprises the second useridentity, a second host identity, and an access session time, whereinthe second host identity and the access session time match the hostidentity and the application session time of the application sessionrecord; store the second user identity in the application sessionrecord; determine, by the security gateway, at least one packet routingpolicy applicable to the application session, the at least one packetrouting policy comprising a host network address, an application networkaddress, and a forwarding interface; receive, at the security gateway, asecond data packet for the application session, the second data packetcomprising a source network address and a destination network address;compare, by the security gateway, the source network address from thesecond data packet with the host network address of the at least onepacket routing policy, or compare the destination network address fromthe second data packet with the application network address of the atleast one packet routing policy; and in response to finding a matchbetween the source network address from the second data packet and thehost network address of the at least one packet routing policy, or amatch between the destination network address from the second datapacket and the application network address of the at least one packetrouting policy, process the second data packet using the forwardinginterface of the at least one packet routing policy by the securitygateway.
 18. The medium of claim 17, wherein the security gatewaycomprises a network interface, wherein the forwarding interface of theat least one packet routing policy indicates a modification to beapplied to the second data packet, wherein the computer readable programcode configured to process is further configured to: in response tofinding the match between the second data packet and the at least onepacket routing policy, modify the second data packet by the securitygateway.
 19. The medium of claim 18, wherein the computer readableprogram code configured to process is further configured to: transmitthe modified data packet using the network interface of the securitygateway.
 20. The medium of claim 18, wherein the modification of thesecond data packet by the security gateway comprises adding a tunnelheader to the second data packet.
 21. The medium of claim 20, whereinthe tunnel header is one of: an IP-IP tunnel header, an L2TP tunnelheader, an IPSec tunnel header, or a layer 2 tunnel header.
 22. Themedium of claim 17, wherein the security gateway is coupled to a networkelement, wherein the forwarding interface of the at least one packetrouting policy directs the security gateway to apply a modification tothe second data packet and send the second data packet to the networkelement, wherein the computer readable program code configured toprocess is further configured to: in response to finding the matchbetween the second data packet and the at least one packet routingpolicy, modify the second data packet by the security gateway.
 23. Themedium of claim 22, wherein the computer readable program codeconfigured to process is further configured to: transmit the modifieddata packet to the network element using a network interface of thesecurity gateway.
 24. The medium of claim 22, wherein the modificationof the second data packet by the security gateway comprises adding atunnel header to the second data packet.